Where is overlay applied DTB on rootfs

That is what I already told you from my initial message. The decompressed dtb from that path does NOT have the custom configurations. However the actively running DTB (ie: by checking /sys/firmware/devicetree/base) does have the customizations applied. You should be able to confirm this issue yourself with any overlay.